SD-WAN SLA measure then steer

Lessons · SD-WAN SLA + strategies · SLA then steer

Hero · two members, one app, SLA decides who carries it

Why the ISP is up and Teams is still bad

Link-up is not path quality. wan1 can ARP its gateway and still carry 40 ms of jitter on the Teams media path. FortiOS only steers on the measurements you configured — protocol, server, participants, failtime, and the SLA target. A Performance SLA with no rule consuming it is a dashboard tile.

The classic ticket is first-match, not a bad circuit:

• No explicit Office 365 / Teams rule — the implicit catch-all load-balances the session onto whichever member its hash picked, including the degraded one.
• A dest-all explicit rule sits above the application rule. First match wins. The app rule never fires.
• The health-check probes 8.8.8.8 while the app path is the Microsoft front door. In-SLA on Google is not in-SLA on Outlook.

Members, SLA, then the rule

Pre-train these four words before you open Network > SD-WAN.

Measure then steer

Order is the whole job. Skip the SLA and Lowest Cost (SLA) has nothing to read. Skip the explicit rule and the SLA has nobody to talk to.

Path · SLA diamond, then steer or skip

Rules vs implicit · how to steer the app

SD-WAN rules are first-match, top down, same mental model as a firewall policy. The last row is not a rule you created — it is the implicit catch-all FortiOS always has.

Runbook Side A / B / C

Lab: LAN 10.20.20.0/24, zone virtual-wan-link, wan1 gw 203.0.113.1 cost 10, wan2 gw 198.51.100.1 cost 5, health-check Office365. HTTP/HTTPS DIA. Do not invent a third overlay on this page.

Side A — underlay, zone, policy

1. Enroll the members

   Network > SD-WAN > SD-WAN Zones — enable SD-WAN, keep zone virtual-wan-link, add wan1 and wan2 with gateways and costs. CLI: config system sdwan → config members. A member that is not in the zone is invisible to every rule.

2. Default route + firewall policy

   Static default whose outgoing interface is the zone, not a single WAN. Policy: srcintf=lan → dstintf=virtual-wan-link, NAT on, log all sessions. If clients still have a more-specific route out wan1, SD-WAN never sees the packet. Source: FortiOS “Configuring the SD-WAN interface.”

Side B — measure, then write the app rule

1. Performance SLA on the members

   Network > SD-WAN > Performance SLAs — create Office365. Protocol ping or HTTP toward a server on the app path. Participants: Specify wan1 + wan2 (not every overlay you never use). Enable SLA Target. Set latency 100, jitter 30, packet-loss 1. Lowest Cost (SLA) and Maximize Bandwidth require this target; Manual / Best Quality do not. Source: Link health monitor / Performance SLA overview.

2. Explicit application rule above implicit

   Network > SD-WAN > SD-WAN Rules — Create New. Name Office365. Destination: Internet Service Microsoft-Office365 (add Microsoft-Teams if that is the ticket). Strategy: Lowest Cost (SLA). Interface preference: wan1, wan2. Required SLA target: Office365#1. Save. Confirm it sits above any dest-all rule and above implicit.

3. Leave implicit for leftover bulk

   Do not “fix” implicit by pinning it to wan1. Implicit is the bucket for traffic you have not identified. Source-IP or session load-balance is fine for generic HTTPS. It is not fine for the meeting.

config system sdwan
    set status enable
    config members
        edit 1
            set interface "wan1"
            set gateway 203.0.113.1
            set cost 10
        next
        edit 2
            set interface "wan2"
            set gateway 198.51.100.1
            set cost 5
        next
    end
    config health-check
        edit "Office365"
            set server "outlook.office365.com"
            set members 1 2
            config sla
                edit 1
                    set latency-threshold 100
                    set jitter-threshold 30
                    set packetloss-threshold 1
                next
            end
        next
    end
    config service
        edit 1
            set name "Office365"
            set mode sla
            set internet-service enable
            set internet-service-name "Microsoft-Office365"
            set health-check "Office365"
            set priority-members 1 2
        next
    end
end

Side C — proof

1. SLA bits

   diagnose sys sdwan health-check Office365 — each seq shows state(alive), latency / jitter / packet-loss, and sla_map. In-SLA is 0x1 for target 1. Out-of-SLA is 0x0. Dead is not the same as out-of-SLA: dead failed failtime; out-of-SLA is alive but above threshold.

2. Selected member

   diagnose sys sdwan service — Service(1) Mode(sla), Members listed with selected on the cheapest in-SLA seq. If Office 365 sessions still egress wan1, the rule did not match (ISDB miss, or a dest-all above it). Source: FortiOS diagnose examples on Performance SLA / service.

3. Forward traffic log

   Generate one Outlook session from 10.20.20.40. Log & Report > Forward Traffic: dstintf should be wan2 while wan2 is in-SLA. If dstintf is wan1 and sla_map on wan1 is 0x0, you matched implicit or the wrong rule.

One session after commit

After the rule is saved, an Outlook session from the LAN does this:

1. Packet hits the firewall policy lan → virtual-wan-link. Permit is not a path yet.
2. SD-WAN walks explicit rules top-down. ISDB Microsoft-Office365 matches rule 1 on the first packet.
3. Strategy Lowest Cost (SLA) reads health-check Office365. Members with sla_map=0x0 are skipped. Among remaining, lowest cost wins — lab: wan2 cost 5 over wan1 cost 10.
4. Session is sticky on that member. A later jitter spike that takes wan2 out-of-SLA can fail the member for new sessions; existing stickiness depends on SLA fail/recovery timers — do not assume mid-flow teleport.
5. Unmatched bulk HTTPS never entered step 2. Implicit hashed it. The Office365 SLA did not vote.

Traps + proof

Proof · selected member in diagnose, not a green WAN icon

Sources

• FortiOS Administration Guide — Link health monitor (latency / jitter / loss; SLA target required for Lowest Cost and Maximize Bandwidth; last-30-probe latency/jitter; last-100-probe loss)
• FortiOS Administration Guide — Performance SLA overview (participants must be members; active vs passive; SLA target defaults 5 ms / 5 ms / 0%)
• FortiOS Administration Guide — Implicit rule (unmatched traffic; load-balance algorithms; default route via the SD-WAN zone)
• FortiOS Administration Guide — Dynamic application steering with lowest cost and best quality strategies
• FortiOS Administration Guide — SD-WAN rules — lowest cost (SLA) (set mode sla; cost 0 = most preferred)
• FortiOS CLI — config system sdwan / config health-check / config sla / config service; diagnose sys sdwan health-check · diagnose sys sdwan service

Related: SD-WAN SLA + five strategies · SD-WAN + ZTNA · Policy lookup + NAT · FortiGate interview · Troubleshooting command center